We want to share an update on the timeline and plans for deprecating legacy Exchange Online user identity tokens and callback tokens. If your Outlook add-in uses legacy tokens to make calls to Exchange, then this information applies to you.
On April 9, 2024 the Office Platform Team made two major announcements:
- We launched the public preview of Nested App Authentication (NAA), which provides simple authentication and top tier identity protection through APIs designed specifically for add-ins in Office hosts.
- We announced that legacy Exchange user identity tokens and callback tokens will be turned off by default for all Exchange Online tenants as part of Microsoft’s Secure Future Initiative to protect organizations in the current threat landscape. If your add-in uses legacy tokens to make calls to Exchange, you need to migrate from Exchange tokens to using NAA and Entra ID tokens as soon as possible.
Timeline for turning off legacy Exchange tokens
In April, we announced that Exchange tokens will be turned off by default for all tenants in October 2024. This has been updated and you should have more time to move your Outlook add-ins from Exchange tokens to NAA. The following tables list the key milestones based on which channel customers are using. Note that the general availability (GA) date for NAA will vary based on channel. We’ll provide tooling for administrators to reenable Exchange tokens for tenants and add-ins if those add-ins are not yet migrated to NAA.
Current Channel
| Date | Action |
| October 2024 | NAA is GA for Current Channel.</p>
Exchange online tokens are turned off by default for new tenants and existing tenants known not to be using Exchange tokens. The administrator can choose to reenable Exchange tokens on tenants or add-ins as needed.</td> </tr> |
| January 2025 | Exchange online tokens are turned off by default for all tenants.</p>
The administrator can choose to reenable Exchange tokens on tenants and add-ins as needed.</td> </tr> |
| June 2025 | The ability for the administrator to reenable Exchange online tokens is removed. If a tenant or add-in needs Exchange tokens reenabled, the administrator must contact Microsoft. |
| October 2025 | Exchange online tokens are turned off for all tenants and add-ins, including any that were reenabled. |
| Date | Action |
| November 2024 | NAA is GA for Monthly Enterprise Channel.</p>
Exchange online tokens are turned off by default for new tenants and existing tenants known not to be using Exchange tokens. The administrator can choose to reenable Exchange tokens on tenants or add-ins as needed.</td> </tr> |
| February 2025 | Exchange online tokens are turned off by default for all tenants.</p>
The administrator can choose to reenable Exchange tokens on tenants and add-ins as needed.</td> </tr> |
| June 2025 | The ability for the administrator to reenable Exchange online tokens is removed. If a tenant or add-in needs Exchange tokens reenabled, the administrator must contact Microsoft. |
| October 2025 | Exchange online tokens are turned off for all tenants and add-ins, including any that were reenabled. |
| Date | Action |
| January 2025 | NAA is GA for Semi-annual Channel.</p>
Exchange online tokens are turned off by default for all tenants. The administrator can choose to reenable Exchange tokens on tenants and add-ins as needed.</td> </tr> |
| June 2025 | The ability for the administrator to reenable Exchange online tokens is removed. If a tenant or add-in needs Exchange tokens reenabled, the administrator must contact Microsoft. |
| October 2025 | Exchange online tokens are turned off for all tenants and add-ins, including any that were reenabled. |
| Date | Action |
| June 2025 | NAA is GA for Semi-annual Channel Extended.</p>
The ability for the administrator to reenable Exchange online tokens is removed. If a tenant or add-in needs Exchange tokens reenabled, the administrator must contact Microsoft.</td> </tr> |
| October 2025 | Exchange online tokens are turned off for all tenants and add-ins, including any that were reenabled. |